🎯 Purpose

✅ Keep Google Chrome automatically updated and make sure updates are applied within 7 days, meeting Essential Eight – Patch Applications (Maturity Levels 1–2).

➡️ Stops Chrome updates being disabled and forces a browser relaunch so downloaded updates actually install.

👥 Who is affected

✅ Devices: All Windows devices with Google Chrome installed
🚫 Exclusions: None

☁️ What is protected

✅ Application: Google Chrome (via Google Update and Chrome ADMX settings)
✅ Type: Settings catalog

🔐 How updates are enforced

Setting	Value
Google Update › Update policy override default	Enabled – Always allow updates (recommended)
Google Update › Auto‑update check period override	Enabled – 240 minutes (every 4 hours)
Chrome › Notify a user that a browser relaunch or device restart is recommended or required	Enabled – Relaunch required (recurring prompt)
Chrome › Set the time period for update notifications	Enabled – 604800000 ms (7 days)

➡️ Chrome checks for updates every 4 hours, and users must relaunch within 7 days of an update being downloaded.

⚙️ What this policy does NOT enforce

🚫 A 48‑hour relaunch deadline (see E8-PatchApps-Google Chrome Updates M3)
🚫 Chrome hardening settings (see E8‑User Application Hardening – Chrome)
🚫 Version pinning or rollback

🟢 Policy status

✅ Enabled
✅ Assigned to all devices

ℹ️ Note: Do not assign this policy and the M3 version to the same devices. Both set the update notification period, which causes an Intune conflict.

📘 Essential Eight Alignment

✅ Patches for web browsers are applied within two weeks of release (ISM‑1691)
ℹ️ Applies to Maturity Levels 1 and 2. Maturity Level 3 uses the M3 policy.

📘 Practical Interpretation (Executive‑Friendly)

This policy ensures that:

✅ Chrome always receives updates
✅ Users cannot postpone a browser update for more than a week

This keeps the most‑used attack surface, the web browser, patched within Essential Eight timeframes.